# serverless-cors-plugin

> Serverless CORS Plugin - Managing Cross-origin resource sharing (CORS) policies

Latest version **0.4.2** (published 2016-09-08) · ISC license · 0 weekly downloads

## Install

```sh
npm install serverless-cors-plugin
pnpm add serverless-cors-plugin
yarn add serverless-cors-plugin
bun add serverless-cors-plugin
```

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support; pre 1.0.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 0.4.2 |
| Published | 2016-09-08 |
| First published | 2015-12-29 |
| Weekly downloads | 0 |
| License | ISC |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 3 |
| Known vulnerabilities | 0 (+2 in 1 direct dependencies) |
| Install scripts | no |
| GitHub stars | 70 |
| Author | Joost Farla |
| Maintainers | joostfarla |
| Keywords | serverless, aws, lambda, cors |

## Links

- npm: https://www.npmjs.com/package/serverless-cors-plugin
- Repository: git@github.com:joostfarla/serverless-cors-plugin
- Homepage: https://github.com/joostfarla/serverless-cors-plugin#readme
- Issues: https://github.com/joostfarla/serverless-cors-plugin/issues
- npm.io page: https://npm.io/package/serverless-cors-plugin

## Dependencies (3)

- [joi](https://npm.io/package/joi.md) ^8.0.1
- [lodash](https://npm.io/package/lodash.md) ^4.3.0
- [bluebird](https://npm.io/package/bluebird.md) ^3.1.1

## Alternatives

- [@opentelemetry/exporter-zipkin](https://npm.io/package/@opentelemetry/exporter-zipkin.md) — 14.8M weekly downloads
- [pusher-js](https://npm.io/package/pusher-js.md) — 2.0M weekly downloads
- [browserify](https://npm.io/package/browserify.md) — 1.7M weekly downloads
- [sqs-consumer](https://npm.io/package/sqs-consumer.md) — 1.7M weekly downloads
- [@sanity/eventsource](https://npm.io/package/@sanity/eventsource.md) — 930.8K weekly downloads

## Recent versions

- 0.4.2 (latest) — 2016-09-08
- 0.4.1 — 2016-03-27
- 0.4.0 — 2016-03-25
- 0.3.2 — 2016-03-11
- 0.3.1 — 2016-02-16
- 0.3.0 — 2016-02-11
- 0.2.1 — 2016-01-27
- 0.2.0 — 2016-01-26
- 0.1.2 — 2016-01-15
- 0.1.1 — 2016-01-02
- 0.1.0 — 2015-12-31
- 0.0.1 — 2015-12-29

## README

# Serverless CORS Plugin

A Serverless Plugin for the [Serverless Framework](http://www.serverless.com) which
adds support for CORS ([Cross-origin resource sharing](https://en.wikipedia.org/wiki/Cross-origin_resource_sharing)).

[![serverless](http://public.serverless.com/badges/v3.svg)](http://www.serverless.com)
[![npm version](https://badge.fury.io/js/serverless-cors-plugin.svg)](https://badge.fury.io/js/serverless-cors-plugin)
[![Build Status](https://travis-ci.org/joostfarla/serverless-cors-plugin.svg?branch=develop)](https://travis-ci.org/joostfarla/serverless-cors-plugin)
[![Dependencies Status](https://david-dm.org/joostfarla/serverless-cors-plugin.svg)](https://david-dm.org/joostfarla/serverless-cors-plugin)
[![DevDependencies Status](https://david-dm.org/joostfarla/serverless-cors-plugin/dev-status.svg)](https://david-dm.org/joostfarla/serverless-cors-plugin#info=devDependencies)

**THIS PLUGIN REQUIRES SERVERLESS V0.5 OR HIGHER!**

## Introduction

This plugins does the following:

* It will add CORS response headers to all resource methods with a CORS-policy
  configured.

* It will add an `OPTIONS` preflight endpoint with the proper headers for all
  resources with a CORS-policy configured.

## Installation

In your project root, run:

```bash
npm install --save serverless-cors-plugin
```

Add the plugin to `s-project.json`:

```json
"plugins": [
  "serverless-cors-plugin"
]
```

To find the best compatible (major) version, use the table below:

Serverless version | Plugin version
---|:---
v0.1 | v0.1
v0.2-v0.3 | v0.2
v0.4 | v0.3
v0.5 | v0.4

## Usage

Add the following properties to `s-function.json` to configure a CORS-policy:

```json
"custom": {
  "cors": {
    "allowOrigin": "*",
    "allowHeaders": ["Content-Type", "X-Amz-Date", "Authorization", "X-Api-Key"]
  }
}
```

The `allowOrigin` property is required, the other headers are optional. You can also add this
configuration to `s-project.json` instead of `s-function.json` to apply the CORS-policy
project-wide.

Run `endpoint deploy` and the CORS headers will dynamically be configured and deployed.
Use the `-a` / `--all` flag to deploy pre-flight OPTIONS endpoints.

*Caution: you will probably notice some warnings on missing `stage` and `region`
template variables. These can be ignored until the [issue](https://github.com/joostfarla/serverless-cors-plugin/issues/19#issuecomment-200816508) is fixed.*

## Options

These are all options you can use:

Option | Type | Example
---|:---|:---
`allowOrigin` | String | `"*"`
`allowHeaders` | Array | `["Content-Type", "X-Api-Key"]`
`allowCredentials` | Boolean | `true`
`exposeHeaders` | Array | `["Content-Type", "X-Api-Key"]`
`maxAge` | Number | `3600`

For more information, read the [CORS documentation](https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS).

## Roadmap

* Dynamically set origin headers (#2)
* Add more verbose (debugging) output
* Better support for authenticated requests

## License

ISC License. See the [LICENSE](LICENSE) file.

---
_Source: https://npm.io/package/serverless-cors-plugin · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._